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Abstract.  A  quantum  protocol  is  described  which  enables  a  user  to  send  sealed  messages 
and  that  allows  for  the  detection  of  active  eavesdroppers.  We  examine  a  class  of  eavesdropping 
strategies,  those  that  make  use  of  quantum  operations,  and  we  determine  the  information  gain 
versus  disturbance  caused  by  these  strategies.  We  demonstrate  this  tradeoff  with  an  example 
and  we  compare  this  protocol  to  quantum  key  distribution,  quantum  direct  communication,  and 
quantum  seal  protocols. 


1.  Introduction 

We  have  all  become  accustomed  to  sending  messages  electronically,  whether  by  fax  machine, 
telephone,  computer  or  other  electronic  media.  Most  of  these  messages  contain  data  that  is 
already  publicly  known  or  at  least  easily  found.  Other  messages  are  things  we  would  like  to 
keep  to  ourselves,  and  it  would  be  inconvenient  if  some  third  party  came  across  the  message. 
Still  other  messages  are  extremely  private  and  resources,  jobs,  or  even  lives(!)  might  be  lost  if 
the  message  fell  into  the  wrong  hands.  A  great  deal  of  effort  is  employed  to  encrypt  the  messages 
that  fall  in  this  last  category,  sending  them  with  some  sort  of  code  in  order  to  prevent  any  third 
party  from  understanding  them  even  if  the  messages  are  intercepted.  |Tj 

However,  when  a  message  is  sent  electronically  there  is  no  commonly  available  technology  to 
determine  if  someone  has  been  trying  to  intercept  the  message.  When  sending  typed  letters, 
such  a  technology  does  exist,  albeit  in  an  imperfect  form.  We  often  seal  our  letters  in  envelopes. 
These  envelopes  are  not  secure,  that  is,  they  do  not  prevent  anyone  from  opening  the  envelope 
and  reading  the  letter  inside.  However,  when  an  envelope  is  received  intact,  without  any  tears 
or  other  indication  that  it  has  been  tampered  with,  we  have  a  strong  reason  to  believe  that  the 
message  inside  has  not  been  seen  by  anyone  since  the  earlier  time  when  the  sender  sealed  it. 
Yet  a  seal  on  an  envelope  is  not  to  be  wholly  trusted  for  this  task  of  detecting  eavesdroppers. 
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A  skilled  person  might  be  able  to  examine  the  contents  of  the  sealed  envelope  in  any  number 
of  ways:  by  using  x-rays  or  other  similar  non-destructive  testing  methods,  by  steaming  the  seal 
off  and  re-sealing,  or  by  ripping  open  the  envelope  and  then  placing  the  letter  in  a  new,  forged 
envelope  that  matches  the  original  in  every  detail. 

In  this  paper  we  introduce  a  quantum  cryptographic  protocol  that  allows  two  users  to  send 
and  receive  a  message  in  a  manner  that  is,  in  effect,  quite  similar  to  the  use  of  a  sealed 
envelope.  The  receiver  of  the  message  has  the  opportunity  to  check  if  there  have  been  any 
active  eavesdroppers  trying  to  learn  the  contents  of  the  message.  And  similar  to  a  message 
sealed  in  an  envelope,  the  message  remains  unknown  to  anyone  who  is  not  actively  trying  to 
learn  the  contents.  This  protocol  has  the  advantage  over  sealing  letters  in  envelopes  because  the 
limited  types  of  interactions  allowed  by  quantum  mechanics  prevent  someone  from  eavesdropping 
on  the  message  without  leaving  signs  of  the  eavesdropping  activities. 

It  is  important  to  make  it  clear  that  any  messages  sent  using  the  protocol  introduced  here 
are  not  secure.  That  is,  an  eavesdropper  can  always  choose  to  take  some  action  in  order  to 
determine  the  content  of  a  message  sent  using  this  protocol.  (We  give  an  example  of  one  such 
effective  eavesdropping  strategy  below.)  The  quality  that  makes  this  protocol  distinct  from  other 
methods  of  message  transmission  is  that  any  such  active  eavesdropping  strategies  will  cause  an 
appreciable  amount  of  “noise”  that  is  detectable  by  the  message  receiver.  The  analysis  that 
a  message  receiver  undertakes  to  place  a  bound  on  what  an  eavesdropper  could  have  learned 
during  a  particular  message  transmission  is  not  undertaken  here.  This  analysis  can  be  found 
elsewhere.  [2] 

The  goal  of  this  manuscript  is  to  examine  a  certain  class  of  strategies  for  eavesdropping  on  these 
sealed  messages,  and  it  is  divided  into  four  parts:  First,  the  quantum  message  sealing  protocol  is 
introduced.  Following  this,  we  examine  a  certain  class  of  eavesdropping  strategies  and  describe 
what  an  eavesdropper  expects  to  learn  by  employing  such  strategies.  Next,  we  describe  the  type 
and  amount  of  disturbance  the  eavesdropper  will  cause  by  such  an  activity  and  work  out  the 
details  of  an  example  from  this  class  of  eavesdropping  strategies.  We  conclude  with  a  discussion 
of  this  protocol  and  its  similarities  and  differences  to  other  quantum  cryptographic  protocols. 


2.  Message  sealing  protocol 

We  describe  the  protocol  where  the  message  sender  named  Alice  transfers  a  message  to  the 
receiver  named  Bob.  This  message  will  be  a  single  bit  b  which  is  either  zero  or  one.  The 
protocol  utilizes  a  single  quantum  mechanical  system  which  has  two  degrees  of  freedom.  The 
standard  notation  for  such  a  system  is  used,  with  |0)  and  |1)  representing  vectors  that  form  an 
orthonormal  basis.  The  protocol  also  involves  a  number  of  announcements  made  by  the  message 
sender.  These  announcements  are  to  be  considered  as  public  announcements  to  which  everyone 
is  assumed  to  have  access. 

A  process,  referred  to  as  a  single  shot,  will  be  repeated  many  times  and  goes  as  follows: 

Step  1  -  Bob  prepares  a  quantum  system,  which  we  refer  to  as  a  particle,  in  one  of  four  pure 
states:  1 0) ,  1 1) ,  |+)  =  (|0)  +  1 1) )/ x/2,  or  |— )  =  (|0)  —  \l))/^/2.  The  decision  as  to  which  state  to 
prepare  is  made  at  random  with  equal  probability  for  each  state.  He  records  the  state  he  has 
prepared  and  then  he  sends  the  particle  to  Alice. 

Step  2  -  Alice  makes  one  of  two  measurements  with  equal  probability.  She  either  makes  a 
measurement  corresponding  to  o\  =  |+)(+|  —  |— )(— |  or  she  makes  a  measurement  corresponding 
to  CT3  =  |0)(0|  —  1 1) ( 1 1 .  Each  of  these  two  measurements  can  be  said  to  have  a  result  m  that  is 
either  m  =  +1  or  rn  =  — 1. 


Step  3  -  Alice  announces  whether  her  measurement  corresponded  to  a \  or  03. 

Step  4  -  Alice  makes  one  of  two  possible  announcements.  With  probability  pa  she  makes  a 
bit- announcement  (described  immediately  below)  and  with  probability  (1  —  pa)  she  makes  a 
result- announcement.  She  also  makes  it  known  which  of  the  two  types  of  announcement  she  is 
making. 

Bit- Announcement:  She  announces  a  bit  c  that  is  determined  by  using  the  message  bit  b  and 
the  measurement  result.  If  her  measurement  yielded  the  result  m  =  +1  then  her  announced  bit 
c  will  be  the  same  as  the  message  bit  b  and  if  her  measurement  yielded  the  result  m  =  —  1  her 
announced  bit  c  will  be  the  opposite  of  the  message  bit  b. 

Result- Announcement:  She  announces  the  result  of  her  measurement,  m  =  +1  or  m.  =  —  1. 

When  Bob  prepares  the  particle  in  the  state  |0)  or  |1)  and  Alice  makes  a  <73  measurement,  or 
when  Bob  prepares  the  particle  in  the  state  |+)  or  |— )  and  Alice  makes  a  <73  measurement  we  say 
that  Alice’s  measurement  and  Bob’s  state  preparation  have  a  matching  basis.  They  will  have  a 
matching  basis  on  half  the  shots  performed.  When  this  occurs  then  Bob  knows  the  result  of  the 
measurement  without  Alice  having  to  announce  it,  provided  that  the  state  of  the  particle  did 
not  change  from  when  Bob  prepared  it  to  when  Alice  makes  the  measurement.  The  correlations 
between  Bob’s  state  preparation  and  Alice’s  measurement  results  allow  Bob  to  both  determine 
the  message  bit  and  check  the  channel  for  any  disturbances. 

When  Alice  makes  a  measurement  in  the  basis  matching  Bob’s  state  preparation,  Bob  determines 
the  message  by  applying  a  controlled-bit-flip  operation  on  the  announced  bit.  When  the  state 
in  which  he  prepared  the  particle  is  either  |0)  or  |+)  then  the  message  bit  b  is  the  same  as  the 
announced  bit  c  and  if  he  prepared  1 1)  or  |  — )  then  the  message  b  is  the  opposite  of  the  announced 
bit  c. 

From  an  eavesdropper’s  point  of  view,  the  probability  that  the  message  bit  is  one  value  or  the 
other  is  determined  from  the  coded  bit-announcements.  When  both  values  of  the  measurement 
result  are  equally  likely  then  both  values  of  the  message  bit  are  equally  likely  (for  either 
bit-announcement).  The  four  possible  initial  states  that  Bob  prepares  and  the  two  possible 
measurements  were  chosen  so  that  either  measurement  result  is  equally  likely.  Moreover,  the 
only  opportunity  that  an  eavesdropper  has  to  change  these  probabilities  is  to  change  the  state 
of  the  particle  when  it  is  traveling  from  Bob  to  Alice.  The  rules  of  quantum  mechanics  allow 
for  the  state  of  a  quantum  mechanical  system  to  change  in  two  different  ways:  by  a  unitary 
evolution  or  by  a  measurement.  If  we  want  to  describe  the  effects  of  coupling  the  quantum 
system  composed  of  the  particle  to  another  (auxiliary)  quantum  system  and  then  letting  the 
state  of  whole  system  (particle  plus  auxiliary)  change  via  unitary  evolution  of  measurement,  the 
entire  process  can  be  described  as  a  quantum  operation  or  a  generalized  measurement  on  the 
state  of  the  particle  subsystem.  |3] 

In  the  following  sections  we  examine  the  case  of  when  an  eavesdropper  chooses  to  change  the 
state  of  the  particle  by  applying  a  quantum  operation.  It  is  worthwhile  to  emphasize  that  while 
using  this  type  of  eavesdropping  activity  is  not  optimal,  (2]  it  provides  us  with  some  intuition  as 
to  how  this  protocol  can  be  expected  to  work. 


3.  Information  gain  from  quantum  operations 

In  this  section  we  quantify  what  an  eavesdropper  learns  by  applying  a  quantum  operation  to 
change  the  state  of  the  particle  as  it  travels  from  Bob  to  Alice.  We  first  describe  quantum 
operations [3]  and  then  tackle  the  problem  of  quantifying  an  eavesdropper’s  gain  by  using  the 
Shannon  mutual  information.  [4] 


A  quantum  operation  £  acting  on  states  in  Hilbert  space  Ti  is  described  by  a  set  of  operators 
{Ei, . . . ,  En}  subject  to  the  requirement  that  Xa  Ej Et  =  I  where  I  is  the  identity  operator 
acting  on  Ti.  We  say  that  the  quantum  operation  £  maps  the  initial  state  p  to  final  state 
£{p)  =  EjjjEj.  A  quantum  operation  is  a  convex  linear  map  on  the  space  of  mixed  states, 
which  is  to  say  that  if  p  =  pp\  +  (1  —  p)p2  with  0  <  p  <  1,  then  £(p)  =  p£(pi)  +  (1  —  p)£{p2). 
A  special  class  of  quantum  operations  are  the  unital  quantum  operations  that  map  the  chaotic 
state,  which  is  \l  where  d  =  dim(7f),  to  itself. 

We  quantify  the  amount  an  eavesdropper  learns  by  using  the  Shannon  mutual  information 
between  two  random  variables:  the  random  variable  B  which  describes  the  possible  values  of 
the  message  and  their  probabilities,  and  the  random  variable  C  which  describes  the  possible 
strings  of  bit-announcements  and  their  probabilities.  These  strings  result  from  the  fact  that 
there  will  be  N  shots,  and  an  announcement  will  be  made  on  each  shot.  On  some  of  the  shots 
only  the  result  of  the  measurement  will  be  announced,  and  this  result  does  not  depend  on  the 
message  in  any  way.  Therefore,  only  the  bit-announcements  will  be  of  any  concern  to  us  in 
quantifying  what  the  eavesdropper  learns. 

The  possible  messages  are  6  =  0  and  6  =  1  with  one-half  prior  probability  each. 

On  each  shot  there  are  four  possible  bit-announcements  —  (a\,  0),  (oq,  1),  (<73, 0),  and  (173, 1)  - 
and  when  N  shots  are  made,  k  of  which  result  in  bit-announcements  (where  0  <  k  <  N ),  there 
are  4fc  possible  bit- announcement  strings.  Because  of  the  probabilistic  nature  of  the  protocol,  the 
number  of  bit-announcements  is  not  fixed.  The  probability  pk  of  making  k  bit-announcements 
is  found  using  the  binomial  distribution 

We  use  the  symbol  c  to  denote  a  bit- announcement  string,  and  we  use  the  symbol  C to 
describe  the  ensemble  of  all  possible  bit-announcement  strings  of  length  k. 

Given  that  there  are  k  bit-announcements,  the  Shannon  mutual  information  I{C ^  :  B )  is 
calculated  using 

1  1  1 

I  (C(k)  :  B)  =  J2  Pr(c)  log  — — -  +  -X]  Pr(c  I  b)  log  Pr(c  |  6)  (1) 

c(fc)  L  nc;  6=0  J 

where  the  sum  over  c®  indicates  that  this  sum  is  taken  over  all  4fc  bit-announcement  strings 
of  length  k.  This  can  be  used  to  determine  the  expected  mutual  information  when  taking  the 
weighted  sum  over  the  various  possible  lengths  of  bit-announcement  strings, 

N 

I(C:B)  =  J2PkI(C^:B)  .  (2) 

k= 0 

This  can  be  calculated  once  the  probabilities  Pr(c|6)  are  known  for  every  c  and  both  values  of 
6.  The  remainder  of  this  section  is  devoted  to  determining  these  probabilities,  which  will  change 
depending  upon  which  quantum  operation  is  applied. 

For  a  given  value  of  the  message,  the  probabilities  of  the  four  bit-announcements  depend  upon 
the  probability  of  Alice  getting  the  m  =  +1  measurement  result.  That  is, 

Pr(<7j,  c  =  6| 6)  =  Pr(m  =  +l|<7j)  Pr(cq)  =  Pr(m  =  +l|<7j)/2  , 

Pr(cr.j,  c  /  6| 6)  =  Pr(ru.  =  — ljcij)  Pr(cJi)  =  Pr(m  =  — l|<7j)/2  , 


Table  1.  The  probabilities  for  the  four  results  relevant  to  the  bit-announcements,  given  that 
an  eavesdropper  acts  with  a  quantum  operation  £\v  that  maps  the  chaotic  state  to  p( Av). 


Pr  (m  =  T 1 1 0"i ,  £\v ) 

Pr(m  =  1 1 0"i ,  £\v ) 

Pr(m  =  +1|<t3,5av) 
Pr(m  =  1 1  03 ,  £\v ) 


5(1  +  Aiq) 
i(l  -  Aui) 

5(1  +  ^3) 

|(1  -  Au3) 


where  i  =  1,3  and  b  =  0,1.  The  notation  Pr(m  =  -T 1 1 ) ,  for  example,  is  used  to  mean  that  this 
is  the  probability  that  the  result  m  =  +1  will  be  found  when  a  measurement  that  corresponds 
to  a i  is  made  on  the  particle  and  Pr(iTj)  is  the  probability  that  the  measurement  corresponding 
to  <Ji  will  be  performed. 

Of  course,  the  machinery  of  quantum  mechanics  requires  us  to  specify  the  state  of  the  particle 
in  order  to  calculate  a  probability  of  a  certain  measurement  result.  From  an  eavesdropper’s 
point  of  view,  if  she  does  nothing  to  the  particle  then  there  are  four  possible  states  with  equal 
probability.  SoPr(m  =  ±l|c7j)  =  j(Tr(i(/±cri)|0)(0|)-|-Tr(i(/±cri)|l)(l|)+Tr(i(/±(jj)|-|-}(+|)+ 
Tr(^(J  ±  o" 2 ) |  — ) ( — | ))  where  i  =  1,3.  By  the  linearity  of  the  Trace  function,  this  is  equivalent  to 
Pr(m  =  ±l|<7i)  =  Tr(i(/  ±  0,;)^/).  In  this  way,  it  is  quite  reasonable  to  say  that  the  state  of 
the  particle,  to  the  eavesdropper’s  best  description,  is  the  chaotic  state  p  =  ^1. 

When  an  eavesdropper  applies  a  quantum  operation  £  to  change  the  state  of  the  particle,  it  will 
in  general  change  each  of  the  four  possible  initial  states  differently.  By  the  linearity  of  the  Trace 
function  and  the  convex  linearity  of  the  quantum  operation  £,  the  probability  of  m  =  ±1  can  be 
calculated  for  the  state  p'  =  £{\l)-  That  is,  Pr(m  =  ±1| cq)  =  Tr(i(I  ±  ai)£{\l))  for  z  =  1,3. 

Every  (generally  mixed)  state  of  a  two-level  quantum  system  can  be  described  by  p{ Av)  = 
tj(I  +  A[t>i<7i  +  V2O2  +  V303])  where  v\  +  v\  +  v\  =  1,  02  =  ic  103,  and  0  <  A  <  1.  This 
“Bloch  sphere”  description  of  the  two-level  state  can  be  pictured  as  a  vector  Av  in  a  real 
three  dimensional  space.  When  £{\l)  =  \{I  +  Afiqtri  +  V2O2  +  ^303]),  the  probabilities  for 
the  four  possible  announcements  are  shown  in  Table  Q]  If  an  eavesdropper  applies  the  same 
quantum  operation  each  time  a  particle  is  sent  from  Bob  to  Alice,  the  probabilities  for  each 
bit-announcement  string  is  found  by  taking  the  product  of  the  probabilities  of  each  of  the  four 
announcements,  with  each  of  the  probabilities  appearing  in  the  product  the  same  number  of 
times  that  that  announcement  appears  in  the  string. 

We  can  now  calculate  the  mutual  information  for  any  quantum  operation  by  calculating  the 
probabilities  for  each  bit-announcement  string  and  then  using  Equations  (]T|)  and  (|2|). 

To  summarize  this  section,  we  have  described  how  to  calculate  the  mutual  information  which 
quantifies  what  an  eavesdropper  expects  to  learn  about  the  message  given  a  particular  quantum 
operation  used  as  an  eavesdropping  strategy.  In  the  next  section,  we  determine  the  amount  of 
“noise”  that  such  eavesdropping  strategies  cause. 


4.  Disturbance  caused  by  quantum  operations 

In  the  previous  section  we  focused  on  the  bit-announcements  and  ignored  the  result- 
announcements.  In  this  section  we  will  do  the  opposite.  The  bit-announcements  are  used 


Table  2.  The  four  events  that  correspond  to  mismatches. 


Bob  prepares  the  state 
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m  =  —  1 

|1> 
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m  =  +1 

by  both  Bob  and  any  eavesdroppers  to  determine  the  message,  but  the  result-announcements 
are  of  no  use  to  the  eavesdropper  and  serve  Bob’s  purpose  to  check  the  channel  for  “noise”. 

There  are  sixteen  different  event  statistics  that  are  kept  by  Bob  relating  to  the  measurement- 
announcements:  four  possible  initial  states,  two  possible  measurement  types,  and  two  possible 
measurement  results  for  each  measurement.  Out  of  these  sixteen,  there  are  four  events  that 
would  be  the  most  surprising  to  Bob,  and  would  each  indicate  that  the  state  of  the  particle, 
when  Alice  measured  it,  was  not  the  same  as  the  one  he  had  prepared.  These  four  types  of  events 
will  be  referred  to  as  mismatches  and  are  shown  in  Table  [2j  The  probability  of  a  mismatch,  on 
a  particular  shot,  is 

Pr (mismatch)  =  Pr(|+),  ci, -1)  +  Pr(|-),  cti, +1)  +  Pr(|0),  cr3, -1)  +  Pr(|l),  a3,  +1) 

=  -  (Pr(cri,  — 1||H-))  +Pr(<ri,+l||— »  +Pr(<r3,— 1||0))  +  Pr(<r3,+l||l») 

=  ^(Pr(-l||+),ci)  +  pr(+l||-),(7i)  +  Pr(-l||0),<r3)  +  Pr(+l||l),<r3)).(3) 

Of  course,  when  Bob  analyzes  the  data,  a  mismatch  can  only  occur  on  a  particular  shot  if  the 
bases  are  matched  up.  A  factor  of  1/2  disappears  when  we  account  for  this  to  give  the  probability 
that  there  will  be  a  mismatch  error  on  a  shot  when  the  bases  are  matched.  For  a  fixed  quantum 
operation  £  employed  by  an  eavesdropper,  these  probabilities  are  easily  calculated.  Note  that 
these  probabilities  depend  upon  the  final  states  £(|+ }(+|),  £{\— ){— |),  £(|0)(0|),  and  £(|1)(1|), 
and  not  just  on  the  evolution  of  the  chaotic  state.  In  general,  there  are  many  different  quantum 
operations  that  have  the  same  effect  on  the  chaotic  state.  (The  exception  to  this  is  when  the 
chaotic  state  is  mapped  to  a  pure  state,  in  which  case  it  is  easily  seen  by  the  convex  linearity  of 
quantum  operations  that  every  initial  state  must  be  mapped  to  that  pure  state.) 

5.  An  Example 

Let  us  now  examine  a  family  of  eavesdropping  strategies  that  utilize  the  quantum  operation 
£x,  where  x  is  a  parameter  which  falls  in  the  range  0  <  x  <  1.  When  x  =  0  the  strategy 
corresponds  to  the  eavesdropper  doing  nothing  (and  as  we  shall  see,  learning  nothing),  and 
when  x  =  1  it  corresponds  to  a  quantum  operation  eavesdropping  strategy  with  the  greatest 
mutual  information. 

The  quantum  operation  £x  can  be  achieved  by  coupling  the  initial  state  p  (from  Bob)  to  an 
auxiliary  quantum  system  in  the  state  | </>) ,  letting  the  coupled  system  evolve  unitarily  (described 
by  some  unitary  operator  U  that  acts  on  the  combined  system)  and  then  tracing  over  the 
auxiliary  system.  The  unitary  operator  acts  as  follows: 

c/(|0>  (S)  |0>)  =  |0>®|F>  =  |r0) 


Table  3.  The  probabilities,  from  the  eavesdropper’s  point  of  view,  of  the  four  possible  bit- 
announcements  for  a  given  value  of  6  when  the  quantum  operation  £x,  introduced  in  Section  [5l 
is  applied. 
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t/(|l)®|0))  =  Vi|0>®  |G>  +  \/rrs|l)®  \F)  =  |Ti)  , 

where  (F\G)  =  0  and  (F\F)  =  (G|G)  =  1.  The  fact  that  (0|l)(<^|</>)  =  (ro|ri)  is  sufficient 
to  show  that  such  a  unitary  operator  U  exists.  The  action  of  the  quantum  operation  £x  on 
any  initial  pure  state  1 77)  is  found  by  tracing  over  the  auxiliary  subsystem  after  performing  the 
unitary  transformation  U : 

£x(\ri){v\)  =  Traux(V (Jr?)  <g>  |0))  ((ry|  <g>  (<f>\)U^  . 

By  the  convex  linearity  of  quantum  operations  we  also  know  the  action  of  £x  on  any  mixed  state 
as  well.  From  the  preceeding  considerations,  it  is  straightforward  to  show  that  £x  acts  on  the 
relevant  initial  states  in  the  following  way: 


£*(|0}{°|)  =  |0)(0| 

£*(|i>(il)  =  Uo)(o|  +  (i-x)|i)(i| 


£z(+)(+)  —  2 

[(1  +  x)  1 0) <0|  +  (1  -  x)  |1)(1|  +  v^(|0)(l|  +  |1){0  )] 

«-0-x-0  =  5 

[(1  +  x)  |0)(0|  +  (1  -  x)  |1){1|  -  VT^x  (|0> (1 1  +  |1)(0|)] 

from  which  it  is  easy  to  see  that 
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1  r 
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=  -(/  + 2:0-3). 


The  probability  of  a  mismatch,  calculated  using  Equation  ([3]),  for  this  quantum  operations  is 

1(1  +X-  y/l-x). 

In  order  to  calculate  the  mutual  information  for  this  quantum  operation,  we  must  be  able 
to  determine  the  values  of  Pr(c|6,  £x),  that  is,  the  probability  of  a  every  string  of  result- 
announcements  c  given  each  value  of  b.  If  a  particular  string  of  k  result-announcements 
c(k,di,d2,d,3,di)  consists  of  (<xi,c  =  0)  announced  d\  times,  (<xi,c=  1)  announced  cfe  times, 
(<r 3 ,  c  =  0)  announced  d 3  times,  and  (03,0=1)  announced  d 4  times  —  in  any  order  —  then  the 
probability  for  this  announcement  to  occur  is 

Pi-(c(k,di,d2,d3,d4)\b  =  0,£xS)  =  (1  +  x)ds  (1  -  x)di  =  px,k,d3,di 

Pr(c(fc,di,d2,d3,  d±)\b=l,£x')  =  (1  -  x)d3  (1  +  x)di  =  qx,k,d3,<k  ■ 


Figure  1.  Mutual  information  as  a  function 
of  x ,  describing  the  amount  an  eavesdropper 
learns  about  the  message  bit  given  that  she 
uses  the  quantum  operation  £x  on  each  shot 
when  Bob  sends  N  =  119  particles  and  Alice 
has  probability  pa  =  0.01  of  making  a  bit- 
announcement  . 


Mismatch  Probability 


Figure  2.  Probability  of  a  mismatch  as  a 
function  of  x  when  an  eavesdropper  uses  the 
quantum  operation  £x  on  each  shot. 


This  calculation  utilizes  the  probabilities  for  the  single  announcements  found  in  Table  [3l  There 
are  k\ / {d^.dil^k  —  d%  —  dj)!)  different  strings  of  k  bit  announcements  that  share  this  same 
probability  (for  each  value  of  b). 

Using  these  results,  we  can  now  calculate  the  mutual  information. 
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If  we  choose  some  exemplary  values  of  pa  and  N,  this  will  give  us  some  numerical  results  for  the 
mutual  information.  Say  that  Alice  sets  pa  =  0.05  and  Bob  agrees  with  Alice  to  send  N  =  119 
particles  in  order  to  communicate  the  value  of  a  single  bit.  This  choice  of  pa  and  N  gives  them 
slightly  more  than  a  95%  chance  of  matching  their  bases  on  a  shot  when  a  result- announcement  is 
made.  The  mutual  information  I(C  :  B ),  when  an  eavesdropper  applies  the  quantum  operation 
£x  on  every  shot,  is  plotted  for  all  values  of  0  <  x  <  1  in  Figure  [TJ  Compare  this  with  the 
disturbance  caused,  quantified  by  the  probability  of  a  mismatch,  by  applying  the  same  quantum 
operation,  which  is  shown  in  Figure  [2j 

As  a  final  note,  this  example  demonstrates  that  a  passive  eavesdropper  learns  nothing  about 
the  message.  That  is,  if  we  describe  a  passive  eavesdropper  as  someone  who  is  only  listening 
to  the  announcements  that  Alice  makes  but  does  not  interfere  with  the  particles  in  any  way,[l] 
that  person’s  eavesdropping  strategy  would  correspond  to  £x  when  x  =  0.  It  is  easily  seen  from 
the  Figures  that  this  strategy  causes  the  eavesdropper  to  learn  nothing  and  also  to  causes  no 
disturbance. 


6.  Discussion 

This  protocol  represents  something  new  in  the  field  of  cryptography.  It  provides  the  message 
receiver  with  a  way  to  check  if  an  eavesdropper  is  attempting  to  access  the  message.  The  analysis 


shown  here  demonstrates  both  the  amount  learned  by  an  eavesdropper  and  the  disturbance 
caused,  measured  in  the  number  of  mismatches,  when  an  eavesdropper  employs  a  particular 
quantum  operation. 

As  shown  in  the  example  above,  this  protocol  is  not  secure  against  active  attacks  in  which  an 
eavesdropper  interacts  with  the  particles  as  they  travel  from  the  message  receiver  to  the  message 
sender.  However,  this  example  also  demonstrates  that  such  attacks  cause  a  disturbance  in  the 
system,  which  can  be  quantified  by  the  number  of  mismatches  found  by  the  message  receiver.  A 
more  general  analysis  a  message  receiver’s  bound  on  the  amount  of  information  an  eavesdropper 
could  have  learned  during  a  particular  transmission  is  taken  up  elsewhere.  [2] 

The  protocol  discussed  here  has  similarities  to  other  quantum  cryptography  protocols  that 
have  been  introduced  and  it  is  worthwhile  to  examine  these  similarities,  as  well  as  what 
makes  this  current  protocol  distinct.  The  three  types  of  quantum  cryptographic  protocols  that 
will  be  discussed  here  are  quantum  key  distribution  (QKD)  protocols,  quantum  secure  direct 
communication  (QSDC)  protocols,  and  quantum  seal  protocols. 

The  main  distinction  between  this  new  protocol  and  the  QKD  protocols  is  that  the  goal  of 
QKD  is  to  develop  a  shared  private  key  between  two  parties  while  here  it  is  important  that  a 
particular  message  gets  transmitted.  Said  in  a  different  way,  each  party  in  a  QKD  setting  starts 
with  nothing  and  ends  up  with  a  random  string  of  bits,  but  neither  one  of  them  cares  which 
string  of  bits  results  from  the  process,  so  long  as  they  share  the  same  one.  Here,  one  party  starts 
with  a  particular  string  of  bits  —  the  message  —  and  when  the  process  ends  the  other  party  will 
(hopefully)  have  the  message  as  well.  (There  is  a  tunably  small  probability  that  the  process  will 
be  unsuccessful.  [2])  Of  course,  in  QKD  the  random  string  of  bits  can  later  be  used  to  encrypt 
a  message  (which  can  be  sent  on  a  classical  channel),  but  the  QKD  process  itself  transfers  no 
information. 

It  is  worthwhile  mentioning  that  this  current  protocol  is  very  similar,  in  some  ways,  to  a  specific 
QKD  protocol,  called  BB84.J5]  The  two  protocols  use  the  same  four  initial  possible  states  and 
the  same  two  measurements.  The  difference  between  the  two  is  the  classical  messages  that  are 
sent  and  how  these  messages  are  used.  These  two  protocols  are  so  similar  that  if  two  users  have 
a  system  that  implements  BB84  then  they  should  be  able  to  implement  this  new  protocol  with 
only  minor  modifications  to  the  system. 

The  second  type  of  quantum  cryptographic  protocol  that  we  will  discuss  is  the  so-called 
“quantum  secure  direct  communication”  (QSDC). [6]  The  greatest  similarity  between  the  QSDC 
protocols  and  the  one  introduced  here  is  that  they  both  use  quantum  states  of  some  transferred 
system  to  transmit  a  message  from  one  party  to  another,  rather  than  generating  a  key.  Moreover, 
this  is  done  without  the  use  of  any  pre-shared  key.  However,  the  goal  of  QSDC  is  to  transmit  the 
messages  securely  (that  is,  to  prevent  any  eavesdropper  from  understanding  the  message),  while 
the  goal  of  the  protocol  introduced  here  is  to  detect  the  activity  of  any  active  eavesdroppers. 

The  final  comparison  we  will  make  is  with  those  quantum  cryptographic  protocols  that  have  been 
called  “quantum  seal”  protocols.  [7]  These  quantum  seal  protocols  are  distinct  from  the  current 
one.  The  goal  of  the  quantum  seal  protocols  is  for  a  message  sender  to  prepare  a  quantum 
mechanical  system  in  some  initial  state  so  that  someone  else  can  determine  the  message  by 
making  a  measurement  on  that  quantum  mechanical  system.  Moreover,  the  message  preparer 
also  creates  correlations  between  the  quantum  mechanical  system  and  a  second  quantum 
mechanical  system  so  that  a  measurement  can  be  made,  by  the  message  preparer,  on  the  second 
system  to  determine  if  anyone  has  read  the  message.  The  major  distinction  between  these 
quantum  seal  protocols  and  the  protocol  introduced  here  is  that  protocol  introduced  here  has  a 
preferred  message  receiver  (the  person  who  sends  the  particles  to  the  message  sender)  who  can 


check  if  anyone  else  has  tried  to  read  the  message,  while  in  these  earlier  quantum  seal  protocols [7] 
all  receivers  are  on  equal  footing  and  it  is  the  message  sender  who  can  check  if  someone  has 
accessed  the  message. 

We  conclude  this  discussion  by  emphasizing  that  the  protocol  introduced  here  is  neither  a  QKD 
protocol,  nor  a  QSDC  protocol,  nor  a  quantum  seal  protocol.  It  has  distinct  goals  and  the 
various  security  (or  no-security)  proofs  that  have  been  applied  to  these  earlier  protocols  do  not 
apply  here. 
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